I'm having troubles with reading Request.IsAuthenticated in
Application_AuthenticateRequest.  I have a scenario where I end up with
two .ASPXAUTH cookies, and there's no way in the world I can get rid of
both of them.  I set a new one, but it doesn't matter - IsAuthenticated
always returns false.

Can someone tell me EXACTLY what determines the value of
IsAuthenticated?  An in-depth look at the mechanics would really help
me.